v1.1.2: Merge pull request #50 from GetSHIM/claude/gracious-brown-hb35us

shim-cli 1.1.2

1.1.2 fixes two detector mistakes that real Claude Code sessions ran into: a
number passed to a function lost its opening bracket to a <PHONE_1>, and
shim's own placeholder, quoted in backticks, was counted as a secret.

Upgrading is uv tool upgrade shim or pipx upgrade shim, or
/plugin update shim-cli@shim-cli in Claude Code. The hooks need nothing new:
shim install writes the same entries as in 1.1.1.

A number in code keeps its bracket

A ten-digit number right after ( or [ was masked as a phone number, and the
mask took the bracket with it. An agent that read
EPOCH = datetime.fromtimestamp(1759744800) was handed
EPOCH = datetime.fromtimestamp<PHONE_1>), code that does not parse, and
ipaddress.IPv4Address(3221225985) fared the same.

A bracket the match never closes is no longer part of it, and the number left
is judged the way the same number without a bracket always was: a phone only
when it is Turkish-shaped or follows a cue such as tel or phone. So
fromtimestamp(1759744800) reaches the model unchanged,
SUPPORT = "tel (4155552671)" reaches it as SUPPORT = "tel (<PHONE_1>)", and
(415) 555-2671, whose bracket closes inside the number, is masked whole as
before. A bare ten-digit number in brackets with no cue, such as
contact (4155552671), is now left alone, as contact 4155552671 already was.

shim's own placeholders are not secrets

A model that quotes what it was given writes `DB_PASSWORD=<SECRET_2>`. The
closing backtick made the value <SECRET_2>` instead of a placeholder, so it
was counted as a secret: shim audit listed it under model output, and the
same text in a prompt or tool result was masked again under a new number. A
placeholder followed only by `, *, ., ;, :, !, ? or ) is now
left alone. DB_PASSWORD=<SECRET_2>xyz is still a secret.

Tested on Claude Code 2.1.291

shim doctor claude no longer warns that Claude Code 2.1.291 is newer than
the tested version: every hook event was run on it in real sessions, through
the package and through the plugin's archive. The details are in the
compatibility record.